How should a payment record be described in an investigative report?¶

State what the source recorded, using exact identifiers and status, then explain separately any inference about user, purpose, consent or benefit.

Describe the event before attributing it¶

Identify provider and source type, account or instrument, reference, amount, currency, status and timestamp meaning. Record sender, recipient or merchant as provider fields rather than assumed people. Explain pending, reversal, refund, duplicate or correction and limitations in a customer view or export.

Make the attribution chain visible¶

Describe endpoint, session, IP-related and authentication evidence separately and identify the communications, device or other records that support a named operator. State what remains unproved, including informed consent, location or beneficial ownership.

Use fact, inference and opinion consistently and avoid shorthand such as “the suspect paid” unless the full evidential link supports it.